DNS SAD DNS and NLnet Labs DNS software Update 18 November 2021: we are aware of the follow-up paper published by the researchers. The text below remains accurate for Unbound users. Please note that Unbound 1.13.2 and newer has IPv6 PMTU disabled for UDP. During the ACM CCS conference 2020, held November 9-13, researchers from UC
RPKI Why Routinator Doesn’t Fall Back to Rsync When creating software, we carefully weigh each design decision: security, resiliency, usability and many more factors play a role in the end result. This article explores the reasoning behind a behaviour that isn't specified in an RFC but which has significant impact on operators deploying RPKI.
Research Journeying into XDP Part 1: Augmenting DNS How can eXpress Data Path (XDP) augment existing DNS software? We share our experiences of implementing Response Rate Limiting in XDP.
RPKI Testing .. 123 Delegated RPKI Validate your delegated RPKI deployment with the new NLnet Labs RPKI test root.
Research Journeying into XDP: Part 0 Network programming using XDP has been on our radar for a while now. As tooling around this technology has vastly improved, we decided that it was time to finally get our hands dirty and see what this technology is all about.
RPKI Krill Gains Powerful ROA Management Based on BGP Routing Create and maintain Route Origin Authorisations based on the BGP announcements with your address space.
Dev IPv6 and Rust How difficult is it to use Rust and its ecosystem to write network applications that support IPv6?
Research Adapting Radix Trees NLnet Labs continuously strives to push the performance of its products. Over the course of the past year we researched improvements to main-memory databases for our authorative nameserver, NSD.
DNS Tuning NSD for even better performance NLnet Labs is pleased to announce version 4.3.0 of NSD. This release contains, among bug fixes, features to tune NSD for even better performance. Most notably, processor affinity.
RPKI Evolving Krill Introducing Krill 0.5.0 ‘Serve no Turf’, which includes a user interface for easy management and many other improvements.
DNS Response Policy Zones in Unbound We are incredibly happy to introduce Unbound 1.10. This release features RPZ, a mechanism that makes it possible to define your local policies in a standardized way, and load your policies from external sources.
Misc On adopting a Code of Conduct for NLnet Labs At NLnet Labs, we have recently adopted a code of conduct that applies to all our projects and the interactions with our community. In this blog post, we discuss why we did this, how we went about the process and what we learned along the way.
Research Leaping through RPKI history with Ziggy RPKI, the Resource Public Key Infrastructure, is an important cornerstone in securing the BGP routing system on the Internet. In its…
Research Measuring the impact of DNS Flag Day DNS Flag Day 2019 stimulated a lot of awareness, and as a result, the Internet got a little better.
Dev Hackathon @ Africa Internet Summit 2019 The main objectives of the NLnet Labs foundation are the development of Open Source Software and Open Standards; this combination creates…
Dev Prototyping Unbound extensions in minutes with Python and Docker How, theoretically, could one lower the barrier to trying out the connection testing feature of the Internet.nl application.
RPKI Krill — A New RPKI Certificate Authority From outer space to the depths of the sea, NLnet Labs knows no boundaries with their Resource Public Key Infrastructure (RPKI) project.
Research The Ongoing Story of OpenINTEL: Measuring the DNS for Research, Policy and Protocol Improvements Measuring the DNS for Research, Policy and Protocol Improvements.
Misc Building a new home for NLnet Labs Over the last weeks we threw ourselves at creating a brand new website for NLnet Labs, with lots of decisions to make along the way.
DNS Aggressive use of the DNSSEC-Validated cache in Unbound One of the new features in Unbound 1.7.0 is the aggressive use of the DNSSEC-Validated cache, resulting in decreased load on name servers.
DNS The peculiar case of NSEC processing using expanded wildcard records Unbound, Google public DNS, PowerDNS and Dnsmasq contained a flaw that made it possible to downgrade secure connections.
